discordrat | 0300fd4f30013254015adcfa071a76c238b89d0b5c0bb78edf1b3db4bb67ac59 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-01-2025 13:27

Sharing

Report Analysis Logs

General

Target

3X6QB_Client-built.exe
Size

78KB
MD5

cac3ad4234efc39e0e9042c55d9f864c
SHA1

dc8ab47b9aa08d0fe7451f37bd65d17a614b949a
SHA256

0300fd4f30013254015adcfa071a76c238b89d0b5c0bb78edf1b3db4bb67ac59
SHA512

33920c4ca715e60f1d504d081670a44a21817acce93028f7fe33b096ffb1fe437a46241a6fe10c89276c9a652bf41d1f8701c63a3f3d2dfdd51ce4532f4b3dc4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+PPIC:5Zv5PDwbjNrmAE+3IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNDg2ODQ0OTQ4MjI0ODI1NA.GqRuir.m1LgjbdeFUMKWpZprOQy-MTZpg_vlVOqClUMFo
server_id
1334873666978189427

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2648	2828	3X6QB_Client-built.exe	31
PID 2828 wrote to memory of 2648	2828	3X6QB_Client-built.exe	31
PID 2828 wrote to memory of 2648	2828	3X6QB_Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\3X6QB_Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\3X6QB_Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2828 -s 600
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x000000013F560000-0x000000013F578000-memory.dmp

Filesize
96KB

Download
memory/2828-2-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-3-0x000007FEF5630000-0x000007FEF601C000-memory.dmp

Filesize
9.9MB

Download